[MEDIUM] M7: exec()-based filesystem pre-warm in user-create path — fork-bomb risk + NC34 fatal

[rubenvdlinde]

Severity: MEDIUM

Location: lib/Service/SoftwareCatalogue/ContactPersonHandler.php lines 486–507

Description:
The user-create path fires exec("$phpBin -r '...' > /dev/null 2>&1 &") to pre-warm the filesystem for the new user. Two problems:

1. Fork-bomb via C3: Since convertToUser (C3) is unauthenticated, any caller who triggers repeated user creation will cause this exec to fork an unbounded number of PHP processes in the background.

2. NC 34 fatal in forked script: The spawned script calls \OC::$server->get(IUserManager::class) — fatal on NC 34 — inside a background process with no error recovery.

Suggested fix:
Replace exec() with a queued NC background job via IJobList::add(). Move the filesystem setup to the job class so it runs asynchronously under the cron worker's lifecycle management.

---

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Fixed in #357 (merged to development).